Description
builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xinetd | 1:2.3.14-7.1 | — |
| Debian 13 | xinetd | 1:2.3.14-7.1 | — |
| Debian 12 | xinetd | 1:2.3.14-7.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | xinetd | 2:2.3.14-38.el6 | RHSA-2013:0499 |
| RHEL 5 | xinetd | 2:2.3.14-19.el5 | RHSA-2013:1302 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xinetd | 2.3.15-11.3 | openSUSE-SU-2024:10323-1 |
Advisories 3
- RHSA-2013:1302 Red Hat Security Advisory: xinetd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:0499 Red Hat Security Advisory: xinetd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10323-1 xinetd-2.3.15-11.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 1027050 vdb-entry
- [oss-security] 20120509 CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port mailing-list
- FEDORA-2012-8041 vendor-advisory
- 81774 vdb-entry
- xinetd-tcpmux-weak-security(75965) vdb-entry
- https://bugzilla.redhat.com/attachment.cgi?id=583311
- RHSA-2013:1302 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=790940
- FEDORA-2012-8061 vendor-advisory
- [oss-security] 20120510 Re: CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port mailing-list
- 53720 vdb-entry
- MDVSA-2012:155 vendor-advisory
- http://www.xinetd.org/#changes